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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)E3 Responsive to communication(s) filed on 24 October 2007 . 
2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) [3 Claim(s) 1-6,8-23.25-37 and 39-41 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. . 

6) E3 Claim(s) 1-6.8-23, 25-37 and 39-41 is/are rejected. 

7) EI Claim(s) 22 is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) ^ The drawing(s) filed on 14 March 2005 is/are: a)E3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) £3 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)S All b)D Some * c)Q None of: 

1 Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



1. 



Claims 7, 24 and 38 have been cancelled. 



2. 



Claims 39-41 have been added 



2. 



Claims 1-6, 8-23 and 25-37 and 39-41 have been examined. 



3. 



Responses to Applicant's remarks have been given. 



Continued Examination Under 37 CFR 1.114 



1. A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1 .1 14, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
10/24/07 has been entered. 



2. Claim 22 objected to because of the following informalities: grammatical error. 
The amended claim language on page 7 reads "a malicious softwares is detected". The 
Examiner recommends correcting this claim language (e.g., "a malicious software is 
detected" or "malicious softwares are detected"). Appropriate correction is required. 



Claim Objections 
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Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 1, 2, 3, 5, 14-21, 31, 34 and 39 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 

3. The above mentioned claims possess the claim language "adapted". It has been 
held that the recitation that an element is "adapted to" perform a function is not a 
positive limitation but only requires the ability to so perform. It does not constitute a 
limitation in any patentable sense. Please refer to In re Hutchison, 69 USPQ 138 for 
further clarification. Appropriate correction is required. 

Claim Rejections - 35 USC § 102 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

Claims 1-6, 8-23, 25-37 and 39-41 are rejected under 35 U.S.C. 102(e) as being 
anticipated by United States Patent Application Publication No. US 2002/0116639 to 
Chefalas et al., hereinafter Chefalas. 

4. Regarding claim 1 , Chefalas discloses a security system for repelling malicious 
softwares in computers and computer networks and that is adapted to forward 
messages, the security system comprising a first sub-system to detect unknown 
malicious softwares , said first sub-system being adapted in connection with the 
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forwarding of messages or with other action or, in a timed manner, to perform one or 
more predetermined actions to activate unknown malicious softwares and to detect the 
activated unknown malicious softwares by detecting consequences of activation of the 
malicious softwares (page 1, paragraph 12, page 2, remainder of paragraph 12 and 
paragraph 28, "VSC 126 at server 106 immediately severs the connection with client 
112 and all other clients connected to the server", page 3, remainder of paragraph 28 
and paragraphs 30 and 32, page 4, paragraph 46 and page 5, paragraph 54). 

5. Regarding claim 2, Chefalas discloses the security system in accordance with 
claim 1 , that is adapted to forward an alarm caused by the detection of the malicious 
softwares to at least one system connected to the security system (page 1 , paragraph 
12, page 2, remainder of paragraph 12 and paragraph 28, "VSC 126 at server 106 
immediately severs the connection with client 112 and all other clients connected to the 
server, page 3, remainder of paragraph 28 and paragraphs 30 and 32, "If the same 
type of virus occurs several times in a specified time interval, server 106 sends a priority 
business event to the remote network administrator at server 1 08" and page 4, 
paragraph 46). 

6. Regarding claim 3, Chefalas discloses the security system in accordance with 
claim 1 , that is further adapted to break a connection to at least one other system on the 
basis of an alarm caused by the detection of the malicious softwares (page 1 , 
paragraph 12, page 2, remainder of paragraph 12 and paragraph 28, "VSC 126 at 
server 106 immediately severs the connection with client 1 12 and all other clients 
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connected to the server", page 3, remainder of paragraph 28 and paragraph 30 and 
page 4, paragraph 46). 

7. Regarding claim 4, Chefalas discloses a second sub-system for forwarding 
messages from the first sub-system to at least one system connected to the security 
system (page 3, paragraph 32, "If the same type of virus occurs several times in a 
specified time interval, server 106 sends a priority business event to the remote network 
administrator at server 108"). 

8. Regarding claim 5, Chefalas discloses a third sub-system that is adapted to 
break a connection to at least one other sub-system upon receiving an alarm (page 1, 
paragraph 12, page 2, remainder of paragraph 12 and paragraph 28, "VSC 126 at 
server 106 immediately severs the connection with client 112 and all other clients 
connected to the server", page 3, remainder of paragraph 28 and paragraph 30, page 4, 
paragraph 46 and page 5, paragraph 54). 

9. Regarding claim 6, Chefalas discloses wherein the at least one other sub-system 
includes an identifier which corresponds to an identifier of the third sub-system (page 4, 
paragraphs 44, 45 and 47 and page 5, paragraph 58). 

10. Regarding claim 8, Chefalas discloses wherein the alarm is a message or at 
least a part of a message that is forwarded to the recipient prior to other 
communications (page 1 , paragraph 12, page 2, remainder of paragraph 12 and 
paragraph 28, "VSC 126 at server 106 immediately severs the connection with client 
112 and all other clients connected to the server" and page 3, remainder of paragraph 
28). 
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1 1 . Regarding claim 9, Chefalas discloses wherein the third sub-system includes at 
least one computer or one network element including a computer (page 3, paragraph 
32, "If the same type of virus occurs several times in a specified time interval, server 
106 sends a priority business event to the remote network administrator at server 108"). 

12. Regarding claim 10, Chefalas discloses wherein the alarm is forwarded via a 
separate connection (page 1, paragraph 12 and page 3, paragraph 32, "If the same type 
of virus occurs several times in a specified time interval, server 106 sends a priority 
business event to the remote network administrator at server 108"). 

13. Regarding claim 1 1 , Chefalas discloses wherein the one or more predetermined 
actions include at least one of altering the time data, altering the contents of the 
memory, handling of files or at least its partial simulation (page 4, paragraph 44). 

14. Regarding claim 12, Chefalas discloses wherein the consequences of activation 
of the malicious softwares detected by the first sub-system include at least one of: a 
change takes place in the first sub-system prior to actions causing changes carried out 
by the first sub-system, a change takes place in the first sub-system that is not an action 
taken by the first sub-system to detect the malicious softwares , a message leaves for 
another system without command from the first sub-system, a message leaves for 
another system to a wrong address or to a system which no communication has been 
directed to, and a message does not leave for another system although it has been sent 
there (page 1, paragraph 12, page 3, paragraph 30 and page 5, paragraph 54). 
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15. Regarding claim 13, 27 and 35, Chefalas discloses wherein the one or more 
predetermined actions include plural actions that take place either simultaneously or 
consecutively in time (page 4, paragraph 46). 

16. Regarding claim 14, 28 and 36, Chefalas discloses wherein the first sub-system 
is adapted to choose one or more of the following logics when trying to activate the 
malicious softwares : 

one defined by the user, pre-programmed or at least partially random logic (page 5, 
paragraph 60). 

17. Regarding claim 15, Chefalas discloses further comprising a parallel system that 
is adapted to save a message sent from the third sub-system, the parallel system being 
connected in parallel with the third sub-system (page 1, paragraph 12, page 3, 
paragraph 30 and page 5, paragraph 54). 

18. Regarding claim 16, Chefalas discloses wherein the first sub-system is adapted 
to compare in the parallel system a message sent from the third sub-system to the first 
sub-system and additionally saved in the parallel system in order to detect an anomaly 
caused by a malicious software (page 1, paragraph 12, page 3, paragraph 30 and page 
5, paragraph 54). 

19. Regarding claim 17, Chefalas discloses wherein the parallel system is adapted to 
forward a message saved by it (page 1, paragraph 12, page 3, paragraph 30 and page 
5, paragraph 54). 

20. Regarding claim 18, Chefalas discloses the security system in accordance with 
claim 1, that is adapted to examine messages forwarded through the security system in 
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order to detect known malicious softwares (page 1, paragraph 12, page 3, paragraph 30 
and page 5, paragraph 54). 

21 . Regarding claim 19, Chefalas discloses the security system in accordance with 
claim 4, comprising first and second ones of the at least one system, wherein the 
security system is adapted to transfer data between the first and the second ones of the 
at least one system through the first and the second syb-systems, and wherein the 
security system is adapted to disrupt the connection between the first one of the at least 
one system and the first sub-system before a connection is established between the 
first and the second sub-systems and to disrupt the connection between the first and 
the second sub-systems before a connection is established between the second sub- 
system and the second one of the at least one system (page 1 , paragraph 12, page 3, 
paragraph 30, "shut down the local server and/or the LAN" and page 5, paragraph 54). 

22. Regarding claim 20, Chefalas discloses wherein said first sub-system is adapted 
to compare messages with at least partially identical identifiers with each other in order 
to detect unknown malicious softwares (page 4, paragraphs 44, 45 and 47 and page 5, 
paragraph 58). 

23. Regarding claim 21 , Chefalas discloses wherein the first sub-system is adapted 
to request the sender of the messages with at least partially identical identifiers to re- 
send at least one of the messages and is further adapted to compare at least one re- 
sent message received with the original messages in order to detect messages 
containing malicious softwares (page 4, paragraphs 44, 45 and 47 and page 5, 
paragraph 58). 
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24. Regarding claim 22, Chefalas teaches a method for repelling malicious softwares 
in computers and data networks, the method being carried out in a security system 
including a first sub-system for forwarding messages and for detecting malicious 
softwares and that is isolatable from the remainder of the security system (page 1 , 
paragraph 12, page 2, paragraph 28 and page 3, remainder of paragraph 28 and 
paragraph 30, "shut down the local server and/or the LAN"), the method includes the 
steps where: 

functions of the security system are monitored by the first sub-system in order to detect 
consequences of activation of an unknown malicious software (page 1, paragraph 12, 
page 2, paragraph 28 and page 3, remainder of paragraph 28 and paragraph 30), the 
consequences of activation including at least one of the following: 
a change takes place in the first sub-system prior to actions causing changes carried 
out by the first sub-system, a change takes place in the first sub-system that is not an 
action taken by the first sub-system to detect a malicious softwares , a message leaves 
for another system without command from the first sub-system, a message leaves for 
another system to a wrong address or to a system which no communication has been 
directed to, and a message does not leave for another system although it has been sent 
there, 

a malicious softwares is detected when one of the consequences is detected, and an 
alarm is given (page 2, paragraph 28 and page 3, remainder of paragraph 28 and 
paragraph 30). 
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25. Regarding claim 23, Chefalas teaches a method for repelling malicious softwares 
in computers and computer networks, the method comprising the steps of: 

taking one of more predetermined actions to activate unknown malicious softwares in 
connection with the forwarding of messages or other action, or in a timed manner, 
detecting the activated unknown malicious softwares by detecting consequences of 
activation of the malicious softwares caused by the one or more predetermined actions, 
and giving an alarm when a malicious software is detected (page 1, paragraph 12, page 
2, remainder of paragraph 12 and paragraph 28 and page 3, remainder of paragraph 28 
and paragraphs 29 and 30). 

26. Regarding claims 25 and 32, Chefalas teaches A method in accordance with 
claim 23, wherein the one or more predetermined actions include at least one of the 
following: altering the time data, altering the contents of the memory, handling of files or 
at least its partial simulation (page 5, paragraphs 50 and 60). 

27. Regarding 26, Chefalas teaches wherein the method is run in a security system 
including a first sub-system and a second sub-system and wherein the consequences of 
activation of the malicious software include at least one of: 

a change takes place in the first sub-system prior to actions causing changes carried 
out by the first sub-system, a change takes place in the first sub-system that is not an 
action taken by the first sub-system to detect a malicious software , a message leaves 
for another system without command from the first sub-system, a message leaves for 
another system to a wrong address or to a system which no communication has been 
directed to, and a message does not leave for another system although it has been sent 
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there (page 1 , paragraph 12, page 2, remainder of paragraph 12 and paragraphs 25 
and 28, page 3, remainder of paragraph 28 and paragraphs 30-32, page 4, paragraphs 
44, 46 and 47 and page 5, paragraph 54). 

28. Regarding claim 29, Chefalas teaches further comprising the step where known 
malicious softwares are searched for on the basis of their characteristics (page 3, 
paragraph 32, "If the same type of virus occurs several times in a specified time interval, 
server 106 sends a priority business event to the remote network administrator at server 
108"). 

29. Regarding claim 30, Chefalas teaches wherein the security system is connected 
to a first system and a second system and wherein data are transferred between the 
first system and the second system through the first sub-system and the second sub- 
system phase by phase in order (page 1, paragraph 12 and page 5, paragraph 54), in 
which phases: 

the connection for data transfer is disrupted between the first system and the first sub- 
system, a connection for data transfer is established between the first sub-system and 
the second sub-system, the connection for data transfer is disrupted between the first 
sub-system and the second sub-system, a connection for data transfer is established 
between the second sub-system and the second system (page 5, paragraph 54). 

30. Regarding claim 31 , Chefalas discloses an apparatus for repelling malicious 
softwares in computers and computer networks, comprising equipment for saving data 
and for handling data and equipment for transferring data with another apparatus, 
wherein the apparatus is adapted to receive a message and to perform one or more 
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predetermined actions to activate unknown malicious softwares contained in the 
message and to detect the activated unknown malicious softwares by detecting 
consequences of activation of the malicious softwares (page 2, paragraph 28 and page 
3, remainder of paragraph 28 and paragraph 30). 

31 . Regarding claim 33, Chefalas discloses wherein the consequences of activation 
of the malicious software include at least one of: a change takes place prior to actions 
caused by changes made by the apparatus, a change takes place that is not an action 
taken by the apparatus to detect a malicious software (page 1 , paragraph 12, page 2, 
remainder of paragraph 12 and paragraphs 23 and 27). 

32. Regarding claim 34, Chefalas discloses wherein the apparatus is adapted to 
send a message to either a sub-assembly of the apparatus or to said another apparatus 
(page 3, paragraph 32, "If the same type of virus occurs several times in a specified 
time interval, server 106 sends a priority business event to the remote network 
administrator at server 108"), and wherein the consequences of activation of the 
malicious software include at least one of: 

a message leaves without authorization from the anti- malicious software of the 
apparatus, a message leaves for an address it has not originally been directed to, a 
message does not leave although it has been given a command to be sent (page 2, 
paragraphs 25 and 28, page 3, remainder of paragraph 28 and paragraphs 30-32 and 
page 4, paragraphs 44, 46 and 47). 

33. Regarding claim 37, Chefalas discloses wherein the apparatus examines the 
message in order to detect known malicious softwares (page 3, paragraph 32, "If the 
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same type of virus occurs several times in a specified time interval, server 106 sends a 
priority business event to the remote network administrator at server 108"). 
34. (new) Regarding claim 39, Chefalas discloses a security system for repelling 
malicious software in a computer and that is adapted to forward messages, the security 
system comprising: 

a first sub-system that detects unknown malicious software, said first sub-system being 
adapted, in connection with forwarding of messages or with another action in a timed 
manner, to activate an unknown malicious software by detecting a consequence of the 
activation of the malicious software (page 1, paragraph 12, page 2, remainder of 
paragraph 12 and paragraph 28, "VSC 126 at server 106 immediately severs the 
connection with client 112 and all other clients connected to the server", page 3, 
remainder of paragraph 28 and paragraphs 30 and 32, "If the same type of virus occurs 
several times in a specified time interval, server 106 sends a priority business event to 
the remote network administrator at server 108" and page 4, paragraph 46); 
an analyzing sub-system that receives files contaminated with an unknown malicious 
software from said first sub-system and that analyzes the unknown malicious software 
to provide fingerprints of the unknown malicious software and that forwards the 
fingerprints (page 1, paragraph 12, page 2, remainder of paragraph 12 and paragraph 
28, "If the detected virus is the type of virus that can be replicated or cloned, VSC 128 at 
server 106 immediately severs the connection with client 112 and all other clients 
connected to the server", page 3, remainder of paragraph 28 and paragraphs 29, 
"benign viruses", 30 and 32, "If the same type of virus occurs several times in a 
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specified time interval, server 106 sends a priority business event to the remote network 
administrator at server 108" and page 4, paragraphs 44 and 46). 

35. (new) Regarding claim 40, Chefalas discloses wherein the security system 
communicates with the computer network being protected by the security system, but is 
separate from the computer network (page 1, paragraph 12 and page 3, paragraph 32, 
"If the same type of virus occurs several times in a specified time interval, server 106 
sends a priority business event to the remote network administrator at server 108"). 

36. (new) Regarding claim 41 , Chefalas discloses wherein the security system is in a 
gateway for the computer network (page 1, paragraph 12, page 3, paragraph 32, "If the 
same type of virus occurs several times in a specified time interval, server 106 sends a 
priority business event to the remote network administrator at server 108" and page 5, 
paragraph 59, "firewalls, servers or monitoring devices"). 

Response to Arguments 

37. Applicant's arguments, see page 13, filed 10/24/07, with respect to the 35 U.S.C. 
112, 2 nd paragraph rejection of claim 8 have been fully considered and are persuasive. 
The 35 U.S.C. 112, 2 nd paragraph rejection of claim 8 has been withdrawn. 

38. Applicant's arguments filed 10/24/07 have been fully considered but they are not 
persuasive. The Examiner maintains the above-cited grounds of rejection. Further, with 
regards to the claim language of "malicious softwares", it is broadly interpreted by the 
Examiner that said "malicious softwares" encompasses, inter alia, the viruses as 
disclosed by Chefalas. 
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39. Pertaining to claims 39-41 , the claim language "fingerprints", within the context 
as defined by the Applicant within the Specification, is broadly interpreted by the 
Examiner to pertain to characteristics/attributes of the claimed "malicious software". 

Conclusion 

40. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

41 . The following United States Patents are cited to further show the state of the art 
with respect to virus detection and removal, such as: 

United States Patent No. 7,137,034 to Largman et al., which is cited to show a 
self repairing computer having user accessible switch for modifying bootable storage 
device configuration to initiate repair. 

United States Patent No. 6,873,988 to Hermann et al., which is cited to show 
system and methods providing anti-virus cooperative enforcement. 

United States Patent No. 7,089,589 to Chefalas et al., which is cited to show a 
method and apparatus for the detection, notification and elimination of certain computer 
viruses. 

United States Patent No. 7,171,690 to Kouznetsov et al., which is cited to show a 
wireless malware scanning back-end system and method. 

42. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jeremiah Avery whose telephone number is (571) 272- 
8627. The examiner can normally be reached on Monday thru Friday 8:30am-5pm. 
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43. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

44. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



JLA 
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